It would be better directing this question at the Arquilian team. I don't (and cannot) really know what could be going wrong here without knowing what Arquilian is doing. The agent parameters on the command line look ok as far as any Byteman setup is concerned. After that I cannot tell why you might be seeing an NPE without more details about the app.

The agent option "boot:target/jboss-as-7.1.1.Final/jboss-modules.jar" is certainly interesting -- the jar it is placing into the bootstrap path contains the Main class which is seeing the NPE. That may cause loader issues when the same jar is used as the target for the -jar command line option. I would expect the Main class to be directly loaded from the jar file by the system loader rather than accessed via the bootstrap loader. If it's <clinit> method links against to classes in the bootstrap which then link back to the bootstrap loader's version of the Main class then this could easily leave something in the system path version of Main uninitialized which might cause an NPE. Whether or not this sort of cross-loader linking can happen will depend on the semantics of the app rather than Byteman. So, this might be a problem or it might not. And, yes, since we are in the realm of class init it is quite possible that this could work in 7.1.1 but not in 7.2.0.

Similarly, what is happening may depend upon the specifics of the script passed in the agent option "script:src/test/resources/byteman/SecurityLogging.btm". It could be injecting code into the modules Main class for all I know.